AugustInnovations LLC · Documents · Testing Authorization — Template

Testing Authorization — Penetration Testing Permission Letter

[TEMPLATE — to be executed on Client letterhead (or as a countersigned attachment to the Rules of Engagement) before any testing begins. Clinical Perimeter performs no testing without this authorization in hand.]

[CLIENT LETTERHEAD]

Date: [DATE] To: AugustInnovations LLC dba Clinical Perimeter, Plumas Lake, California Re: Authorization to perform web application penetration testing Engagement reference: [ENGAGEMENT ID, e.g., CP-2026-___]

Authorization

[CLIENT LEGAL NAME] ("Client") hereby authorizes AugustInnovations LLC dba Clinical Perimeter ("Clinical Perimeter"), and specifically its tester Taylor Augustin, to perform penetration testing of the application and systems described below, during the window stated below, in accordance with the Rules of Engagement dated [ROE DATE] and the engagement agreement dated [AGREEMENT DATE].

Systems authorized for testing

• Application: [APPLICATION NAME AND VERSION, IF KNOWN]
• Environment: Staging only
• Hostnames / URLs / API base URLs: [LIST — EXHAUSTIVE]
• Test accounts and roles: [LIST OR REFERENCE ATTACHMENT]

No other system, host, account, or environment is authorized. Production systems and any system containing real protected health information are expressly excluded.

Testing window

From [START DATE/TIME, TIME ZONE] to [END DATE/TIME, TIME ZONE]. Authorization expires at the end of the window unless extended in writing by an authorized signatory below.

Authority of signatory

The undersigned represents and warrants that:

1. They are authorized to grant this permission on behalf of Client.
2. Client owns the systems listed above, or has obtained all permissions necessary from their owners and hosting providers to authorize this testing.
3. The staging environment listed above contains synthetic data only and no real protected health information.
4. Client has notified its hosting provider / security team as required by its own policies: [YES / NOT APPLICABLE — DELETE ONE IN EXECUTED COPY].

Emergency contact

During the testing window, Client's contact for any incident or question arising from the testing is:

• Name: [NAME] · Title: [TITLE]
• Email: [EMAIL] · Phone: [PHONE]

Signature

[CLIENT LEGAL NAME]

Signature: ______________________________ Name: [NAME] · Title: [TITLE] · Date: __________

---

Acknowledged by Clinical Perimeter:

Signature: ______________________________ Taylor Augustin, AugustInnovations LLC dba Clinical Perimeter · Date: __________